on a fresh installation in Guest and All Roles have some doctypes enabled by default, see pic:
Job Openings and Help Article for Guest Role
BOM and Expense Claim Type for All Role
All this end to the fact that if an user doesn’t have HR Module, Manufacture, Website module enabled, they still get the module listed and the menu can be seen, see pic:
The user actually has this Role:
Is that by design? Could you please double check?
Even worst is not possible to remove Rule from Role Manager, it is needed to remove directly from Database, but it get reloaded on each bench update. Can u please double check this as well?
ERPNext: v8.0.7 (master)
Frappe Framework: v8.0.6 (master)